YouTube Comment Thread

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:49 PM UTC
• Version: 0.10.7-dev

Overview

This skill is coherent for managing YouTube comments, but it asks users to install and run an unpinned third-party CLI with OAuth tokens and can post public comments without strong consent or credential-handling guidance.

Review this skill before installing. Use it only if you trust the yutu distribution source, pin or verify the CLI version where possible, keep OAuth client and token files out of shared workspaces and repositories, and require the agent to show the exact video, channel, and comment text for approval before running any insert command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:39

Finding

Unpinned and Unverified Third-Party Executable Installation

Content

View full analysis

Remediation

View remediation

``` 3. For Go, replace `@latest` with an exact semantic version or reviewed commit: ```bash go install github.com/eat-pray-ai/yutu@ ``` 4. Publish SHA-256 checksums for prebuilt binaries and require users to verify the downloaded artifact before placing it in `PATH`. 5. Prefer signed releases and document verification using a trusted signing key or provenance mechanism such as Sigstore. 6. Pin or explicitly document reviewed versions for Homebrew and Winget installations where those package managers support version control or manifest verification. 7. Prefer a local or isolated installation over global installation where practical. 8. Document the OAuth scopes requested by the CLI and use only the minimum scopes required to list or insert comment threads. 9. Protect credential and token files with restrictive filesystem permissions and avoid exposing their contents in logs. 10. Establish a dependency-update process that reviews new versions before updating the pinned references and checks the upstream project for unexpected ownership or publishing changes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This skill documents a command that posts a new YouTube comment thread but does not clearly warn that it will create public content on the user's behalf. In an agent setting, that omission can cause users to trigger an externally visible action without informed consent, leading to reputation damage, spam, or unintended posting from an authenticated account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The setup guide instructs users to create and store OAuth client secrets and cached access tokens, but it does not warn that these files are sensitive credentials that can grant API access if exposed. In a skill context where users may copy files into shared workspaces, repos, or logs, omission of handling guidance materially increases the chance of credential leakage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.